Forum Discussion
lardyboy_lardyb
Nimbostratus
Nimbostratusinserting client ip address into header when using SNAT
iRules novice here !!
I have a need to add the real client IP into the HTTP header when using a SNAT rule, but I need to do it dynamically. this is due to the upstream proxy using client IP addresses to determine policy for web browsing. I understand this can be done somehow using iRules and remote_addr or something - only thing is I am not a software type geeza, so programming for me is like coming to terms with 3 heads !!
has anyone done this before and maybe supply some code, or can anyone shed light on what is needed? help oh help !!
15 Replies
troy_hojel_2205i get the following error from the rule properties page
Error 331835 -- Rule string to tree failed. - syntax error at 'when'
line 2: when HTTP_REQUEST {
when entering.........
when HTTP_REQUEST {
HTTP::header insert ORIG_CLIENT_IP [IP::remote_addr]
}- I'm not sure what's going on here. The format of the error message isn't what I'd expect. Also, it suspicously reports the error on line 2 - what's on line 1? If this problem persists please call support.
Nick_Johnston_2Any info on the error that we are getting? We consistently get the PREPEND_HEADERS error when attempting the TXT file download. We originally thought the extra 2 bytes at the end of the content was causing a problem with BigIP delivering the file, but this following iRule failed to correct the problem.rule handle_two_trailing_bytes { when HTTP_REQUEST { set two_byte_error 0 if { [HTTP::uri] contains "export.fetchFile" } { set two_byte_error 1 } HTTP::header insert ORIG_CLIENT_IP [IP::remote_addr] } when HTTP_RESPONSE { if { $two_byte_error } { set content_len [HTTP::header Content-Length] incr content_len 2 HTTP::header replace Content-Length $content_len } } }
What exactly does the error mean?- The above rule was not complete. If the two extra bytes followed in a separate TCP packet, then the HTTP_RESPONSE_DATA would not have received them at the time it was evaluated. The following rule is more complete in this regard:
rule handle_two_trailing_bytes { when HTTP_REQUEST { set two_byte_error 0 if { [HTTP::uri] contains "export.fetchFile" } { set two_byte_error 1 } HTTP::header insert ORIG_CLIENT_IP [IP::remote_addr] } when HTTP_RESPONSE { if { $two_byte_error } { Get the correct length set content_len [HTTP::header Content-Length] Collect the body and attempt to pick up the 2 extra bytes HTTP::collect [expr $content_len + 2] } } when HTTP_RESPONSE_DATA { Determine how much we collected set delta [expr $content_len + 2 - [HTTP::payload length]] if { $delta < 2 } { HTTP already received extra bytes, remove them here HTTP::payload replace $content_len [expr 2 - $delta] "" HTTP::header replace "Content-Length" $content_len } if { $delta > 0 } { Have TCP layer collect and discard any extra bytes TCP::collect $delta } HTTP::release } when SERVER_DATA { Remove the extra bytes TCP::payload replace 0 $delta "" TCP::release } } 
tonio_tian_1127It's good!
studing!!!!
